npm - strapi-plugin-magic-sessionmanager - Versions diffs - 4.2.11 → 4.2.13 - Mend

strapi-plugin-magic-sessionmanager 4.2.11 → 4.2.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/server/index.js CHANGED Viewed

@@ -219,6 +219,18 @@ var encryption = {
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
 const { hashToken: hashToken$3 } = encryption;
 const lastTouchCache = /* @__PURE__ */ new Map();
+const CACHE_MAX_SIZE = 1e4;
+const CACHE_CLEANUP_AGE = 60 * 60 * 1e3;
+function cleanupOldCacheEntries() {
+  if (lastTouchCache.size < CACHE_MAX_SIZE) return;
+  const now = Date.now();
+  const cutoff = now - CACHE_CLEANUP_AGE;
+  for (const [key, timestamp] of lastTouchCache.entries()) {
+    if (timestamp < cutoff) {
+      lastTouchCache.delete(key);
+    }
+  }
+}
 var lastSeen = ({ strapi: strapi2 }) => {
   return async (ctx, next) => {
     const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
@@ -226,7 +238,30 @@ var lastSeen = ({ strapi: strapi2 }) => {
       await next();
       return;
     }
-    const skipPaths = ["/admin", "/_health", "/favicon.ico"];
+    const skipPaths = [
+      "/admin",
+      // Admin panel routes (have their own auth)
+      "/_health",
+      // Health check
+      "/favicon.ico",
+      // Static assets
+      "/api/auth/local",
+      // Login endpoint
+      "/api/auth/register",
+      // Registration endpoint
+      "/api/auth/forgot-password",
+      // Password reset
+      "/api/auth/reset-password",
+      // Password reset
+      "/api/auth/logout",
+      // Logout endpoint (handled separately)
+      "/api/auth/refresh",
+      // Refresh token (has own validation in bootstrap.js)
+      "/api/connect",
+      // OAuth providers
+      "/api/magic-link"
+      // Magic link auth (if using magic-link plugin)
+    ];
     if (skipPaths.some((p) => ctx.path.startsWith(p))) {
       await next();
       return;
@@ -248,10 +283,8 @@ var lastSeen = ({ strapi: strapi2 }) => {
           ctx.state.sessionUserId = matchingSession.user.documentId;
         }
       } else {
-        if (ctx.state.user && ctx.state.user.documentId) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated for user ${ctx.state.user.documentId}`);
-          return ctx.unauthorized("This session has been terminated. Please login again.");
-        }
+        strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Request blocked - session terminated or invalid (token hash: ${currentTokenHash.substring(0, 8)}...)`);
+        return ctx.unauthorized("This session has been terminated. Please login again.");
       }
     } catch (err) {
       strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
@@ -265,6 +298,7 @@ var lastSeen = ({ strapi: strapi2 }) => {
         const lastTouch = lastTouchCache.get(matchingSession.documentId) || 0;
         if (now - lastTouch > rateLimit) {
           lastTouchCache.set(matchingSession.documentId, now);
+          cleanupOldCacheEntries();
           await strapi2.documents(SESSION_UID$3).update({
             documentId: matchingSession.documentId,
             data: { lastActive: /* @__PURE__ */ new Date() }
@@ -351,20 +385,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = { message: "Logged out successfully" };
             return;
           }
-          const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+          const tokenHashValue = hashToken$2(token);
+          const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
             filters: {
+              tokenHash: tokenHashValue,
               isActive: true
             }
           });
-          const matchingSession = allSessions.find((session2) => {
-            if (!session2.token) return false;
-            try {
-              const decrypted = decryptToken$2(session2.token);
-              return decrypted === token;
-            } catch (err) {
-              return false;
-            }
-          });
           if (matchingSession) {
             await sessionService.terminateSession({ sessionId: matchingSession.documentId });
             log.info(`[LOGOUT] Logout via /api/auth/logout - Session ${matchingSession.documentId} terminated`);
@@ -455,8 +482,10 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             userAgent,
             token: ctx.body.jwt,
             // Store Access Token (encrypted)
-            refreshToken: ctx.body.refreshToken
+            refreshToken: ctx.body.refreshToken,
             // Store Refresh Token (encrypted) if exists
+            geoData
+            // Store geolocation data if available
           });
           log.info(`[SUCCESS] Session created for user ${userDocId} (IP: ${ip})`);
           if (geoData && (config2.enableEmailAlerts || config2.enableWebhooks)) {
@@ -507,20 +536,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
         try {
           const refreshToken = ctx.request.body?.refreshToken;
           if (refreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const refreshTokenHashValue = hashToken$2(refreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: refreshTokenHashValue,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === refreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (!matchingSession) {
               log.warn("[BLOCKED] Blocked refresh token request - no active session");
               ctx.status = 401;
@@ -546,20 +568,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
           const newAccessToken = ctx.body.jwt;
           const newRefreshToken = ctx.body.refreshToken;
           if (oldRefreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const oldRefreshTokenHash = hashToken$2(oldRefreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: oldRefreshTokenHash,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === oldRefreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (matchingSession) {
               const encryptedToken = newAccessToken ? encryptToken$1(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken$1(newRefreshToken) : matchingSession.refreshToken;
@@ -688,11 +703,11 @@ var destroy$1 = async ({ strapi: strapi2 }) => {
   const log = createLogger$2(strapi2);
   if (strapi2.licenseGuard && strapi2.licenseGuard.pingInterval) {
     clearInterval(strapi2.licenseGuard.pingInterval);
-    log.info("🛑 License pinging stopped");
+    log.info("[STOP] License pinging stopped");
   }
   if (strapi2.sessionManagerIntervals && strapi2.sessionManagerIntervals.cleanup) {
     clearInterval(strapi2.sessionManagerIntervals.cleanup);
-    log.info("🛑 Session cleanup interval stopped");
+    log.info("[STOP] Session cleanup interval stopped");
   }
   log.info("[SUCCESS] Plugin cleanup completed");
 };
@@ -1173,6 +1188,7 @@ var session$3 = {
    * GET /api/magic-sessionmanager/my-sessions
    * Automatically uses the authenticated user's documentId
    * Marks which session is the current one (based on JWT token hash)
+   * Fetches geolocation data on-demand if not already stored
    */
   async getOwnSessions(ctx) {
     try {
@@ -1189,7 +1205,8 @@ var session$3 = {
       const config2 = strapi.config.get("plugin::magic-sessionmanager") || {};
       const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
       const now = /* @__PURE__ */ new Date();
-      const sessionsWithCurrent = allSessions.map((session2) => {
+      const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+      const sessionsWithCurrent = await Promise.all(allSessions.map(async (session2) => {
         const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
         const timeSinceActive = now - lastActiveTime;
         const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -1198,6 +1215,39 @@ var session$3 = {
         const deviceType = session2.deviceType || parsedUA.deviceType;
         const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
         const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+        let geoLocation = session2.geoLocation;
+        if (typeof geoLocation === "string") {
+          try {
+            geoLocation = JSON.parse(geoLocation);
+          } catch (e) {
+            geoLocation = null;
+          }
+        }
+        if (!geoLocation && session2.ipAddress) {
+          try {
+            const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+            if (geoData && geoData.country !== "Unknown") {
+              geoLocation = {
+                country: geoData.country,
+                country_code: geoData.country_code,
+                country_flag: geoData.country_flag,
+                city: geoData.city,
+                region: geoData.region,
+                timezone: geoData.timezone
+              };
+              strapi.documents(SESSION_UID$1).update({
+                documentId: session2.documentId,
+                data: {
+                  geoLocation: JSON.stringify(geoLocation),
+                  securityScore: geoData.securityScore || null
+                }
+              }).catch(() => {
+              });
+            }
+          } catch (geoErr) {
+            strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+          }
+        }
         const {
           token,
           tokenHash,
@@ -1206,6 +1256,8 @@ var session$3 = {
           locale,
           publishedAt,
           // Remove Strapi internal fields
+          geoLocation: _geo,
+          // Remove raw geoLocation
           ...sessionWithoutTokens
         } = session2;
         return {
@@ -1213,11 +1265,13 @@ var session$3 = {
           deviceType,
           browserName,
           osName,
+          geoLocation,
+          // Parsed object or null
           isCurrentSession,
           isTrulyActive,
           minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
         };
-      });
+      }));
       sessionsWithCurrent.sort((a, b) => {
         if (a.isCurrentSession) return -1;
         if (b.isCurrentSession) return 1;
@@ -1319,6 +1373,7 @@ var session$3 = {
    * Get current session info based on JWT token hash
    * GET /api/magic-sessionmanager/current-session
    * Returns the session associated with the current JWT token
+   * Fetches geolocation on-demand if not already stored
    */
   async getCurrentSession(ctx) {
     try {
@@ -1347,6 +1402,40 @@ var session$3 = {
       const deviceType = currentSession.deviceType || parsedUA.deviceType;
       const browserName = currentSession.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
       const osName = currentSession.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+      let geoLocation = currentSession.geoLocation;
+      if (typeof geoLocation === "string") {
+        try {
+          geoLocation = JSON.parse(geoLocation);
+        } catch (e) {
+          geoLocation = null;
+        }
+      }
+      if (!geoLocation && currentSession.ipAddress) {
+        try {
+          const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+          const geoData = await geolocationService.getIpInfo(currentSession.ipAddress);
+          if (geoData && geoData.country !== "Unknown") {
+            geoLocation = {
+              country: geoData.country,
+              country_code: geoData.country_code,
+              country_flag: geoData.country_flag,
+              city: geoData.city,
+              region: geoData.region,
+              timezone: geoData.timezone
+            };
+            strapi.documents(SESSION_UID$1).update({
+              documentId: currentSession.documentId,
+              data: {
+                geoLocation: JSON.stringify(geoLocation),
+                securityScore: geoData.securityScore || null
+              }
+            }).catch(() => {
+            });
+          }
+        } catch (geoErr) {
+          strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+        }
+      }
       const {
         token: _,
         tokenHash: _th,
@@ -1354,6 +1443,7 @@ var session$3 = {
         refreshTokenHash: _rth,
         locale: _l,
         publishedAt: _p,
+        geoLocation: _geo,
         ...sessionWithoutTokens
       } = currentSession;
       ctx.body = {
@@ -1362,6 +1452,8 @@ var session$3 = {
           deviceType,
           browserName,
           osName,
+          geoLocation,
+          // Parsed object or null
           isCurrentSession: true,
           isTrulyActive: timeSinceActive < inactivityTimeout,
           minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
@@ -1905,10 +1997,10 @@ var session$1 = ({ strapi: strapi2 }) => {
   return {
     /**
      * Create a new session record
-     * @param {Object} params - { userId, ip, userAgent, token, refreshToken }
+     * @param {Object} params - { userId, ip, userAgent, token, refreshToken, geoData }
      * @returns {Promise<Object>} Created session
      */
-    async createSession({ userId, ip = "unknown", userAgent = "unknown", token, refreshToken }) {
+    async createSession({ userId, ip = "unknown", userAgent = "unknown", token, refreshToken, geoData }) {
       try {
         const now = /* @__PURE__ */ new Date();
         const sessionId = generateSessionId(userId);
@@ -1916,6 +2008,7 @@ var session$1 = ({ strapi: strapi2 }) => {
         const encryptedRefreshToken = refreshToken ? encryptToken(refreshToken) : null;
         const tokenHashValue = token ? hashToken(token) : null;
         const refreshTokenHashValue = refreshToken ? hashToken(refreshToken) : null;
+        const parsedUA = parseUserAgent(userAgent);
         const session2 = await strapi2.documents(SESSION_UID).create({
           data: {
             user: userId,
@@ -1933,8 +2026,22 @@ var session$1 = ({ strapi: strapi2 }) => {
             // Encrypted Refresh Token
             refreshTokenHash: refreshTokenHashValue,
             // SHA-256 hash for fast lookup
-            sessionId
+            sessionId,
             // Unique identifier
+            // Device info from User-Agent
+            deviceType: parsedUA.deviceType,
+            browserName: parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName,
+            osName: parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName,
+            // Geolocation data (if available from Premium features)
+            geoLocation: geoData ? JSON.stringify({
+              country: geoData.country,
+              country_code: geoData.country_code,
+              country_flag: geoData.country_flag,
+              city: geoData.city,
+              region: geoData.region,
+              timezone: geoData.timezone
+            }) : null,
+            securityScore: geoData?.securityScore || null
           }
         });
         log.info(`[SUCCESS] Session ${session2.documentId} (${sessionId}) created for user ${userId}`);
@@ -1995,6 +2102,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get ALL sessions (active + inactive) with accurate online status
+     * Fetches geolocation on-demand for sessions without it (limited to prevent API abuse)
      * @returns {Promise<Array>} All sessions with enhanced data
      */
     async getAllSessions() {
@@ -2007,8 +2115,10 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
+        let geoLookupsRemaining = 20;
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2016,6 +2126,40 @@ var session$1 = ({ strapi: strapi2 }) => {
           const deviceType = session2.deviceType || parsedUA.deviceType;
           const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
           const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+          let geoLocation = session2.geoLocation;
+          if (typeof geoLocation === "string") {
+            try {
+              geoLocation = JSON.parse(geoLocation);
+            } catch (e) {
+              geoLocation = null;
+            }
+          }
+          if (!geoLocation && session2.ipAddress && geoLookupsRemaining > 0) {
+            geoLookupsRemaining--;
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2023,6 +2167,8 @@ var session$1 = ({ strapi: strapi2 }) => {
             refreshTokenHash,
             locale,
             publishedAt,
+            geoLocation: _geo,
+            // Remove raw geoLocation, we use parsed version
             ...safeSession
           } = session2;
           return {
@@ -2030,10 +2176,12 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType,
             browserName,
             osName,
+            geoLocation,
+            // Parsed object or null
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting all sessions:", err);
@@ -2042,6 +2190,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get all active sessions with accurate online status
+     * Fetches geolocation on-demand for sessions without it
      * @returns {Promise<Array>} Active sessions with user data and online status
      */
     async getActiveSessions() {
@@ -2053,8 +2202,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = timeSinceActive < inactivityTimeout;
@@ -2062,6 +2212,39 @@ var session$1 = ({ strapi: strapi2 }) => {
           const deviceType = session2.deviceType || parsedUA.deviceType;
           const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
           const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+          let geoLocation = session2.geoLocation;
+          if (typeof geoLocation === "string") {
+            try {
+              geoLocation = JSON.parse(geoLocation);
+            } catch (e) {
+              geoLocation = null;
+            }
+          }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2069,6 +2252,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             refreshTokenHash,
             locale,
             publishedAt,
+            geoLocation: _geo,
             ...safeSession
           } = session2;
           return {
@@ -2076,10 +2260,11 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType,
             browserName,
             osName,
+            geoLocation,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions.filter((s) => s.isTrulyActive);
       } catch (err) {
         log.error("Error getting active sessions:", err);
@@ -2089,6 +2274,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     /**
      * Get all sessions for a specific user
      * Supports both numeric id (legacy) and documentId (Strapi v5)
+     * Fetches geolocation on-demand for sessions without it
      * @param {string|number} userId - User documentId or numeric id
      * @returns {Promise<Array>} User's sessions with accurate online status
      */
@@ -2107,8 +2293,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2116,6 +2303,39 @@ var session$1 = ({ strapi: strapi2 }) => {
           const deviceType = session2.deviceType || parsedUA.deviceType;
           const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
           const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+          let geoLocation = session2.geoLocation;
+          if (typeof geoLocation === "string") {
+            try {
+              geoLocation = JSON.parse(geoLocation);
+            } catch (e) {
+              geoLocation = null;
+            }
+          }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2123,6 +2343,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             refreshTokenHash,
             locale,
             publishedAt,
+            geoLocation: _geo,
             ...safeSession
           } = session2;
           return {
@@ -2130,10 +2351,11 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType,
             browserName,
             osName,
+            geoLocation,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting user sessions:", err);
@@ -2246,7 +2468,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version = "4.2.10";
+const version = "4.2.13";
 const require$$2 = {
   version
 };

package/dist/server/index.mjs CHANGED Viewed

@@ -215,6 +215,18 @@ var encryption = {
 const SESSION_UID$3 = "plugin::magic-sessionmanager.session";
 const { hashToken: hashToken$3 } = encryption;
 const lastTouchCache = /* @__PURE__ */ new Map();
+const CACHE_MAX_SIZE = 1e4;
+const CACHE_CLEANUP_AGE = 60 * 60 * 1e3;
+function cleanupOldCacheEntries() {
+  if (lastTouchCache.size < CACHE_MAX_SIZE) return;
+  const now = Date.now();
+  const cutoff = now - CACHE_CLEANUP_AGE;
+  for (const [key, timestamp] of lastTouchCache.entries()) {
+    if (timestamp < cutoff) {
+      lastTouchCache.delete(key);
+    }
+  }
+}
 var lastSeen = ({ strapi: strapi2 }) => {
   return async (ctx, next) => {
     const currentToken = ctx.request.headers.authorization?.replace("Bearer ", "");
@@ -222,7 +234,30 @@ var lastSeen = ({ strapi: strapi2 }) => {
       await next();
       return;
     }
-    const skipPaths = ["/admin", "/_health", "/favicon.ico"];
+    const skipPaths = [
+      "/admin",
+      // Admin panel routes (have their own auth)
+      "/_health",
+      // Health check
+      "/favicon.ico",
+      // Static assets
+      "/api/auth/local",
+      // Login endpoint
+      "/api/auth/register",
+      // Registration endpoint
+      "/api/auth/forgot-password",
+      // Password reset
+      "/api/auth/reset-password",
+      // Password reset
+      "/api/auth/logout",
+      // Logout endpoint (handled separately)
+      "/api/auth/refresh",
+      // Refresh token (has own validation in bootstrap.js)
+      "/api/connect",
+      // OAuth providers
+      "/api/magic-link"
+      // Magic link auth (if using magic-link plugin)
+    ];
     if (skipPaths.some((p) => ctx.path.startsWith(p))) {
       await next();
       return;
@@ -244,10 +279,8 @@ var lastSeen = ({ strapi: strapi2 }) => {
           ctx.state.sessionUserId = matchingSession.user.documentId;
         }
       } else {
-        if (ctx.state.user && ctx.state.user.documentId) {
-          strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Session terminated for user ${ctx.state.user.documentId}`);
-          return ctx.unauthorized("This session has been terminated. Please login again.");
-        }
+        strapi2.log.info(`[magic-sessionmanager] [BLOCKED] Request blocked - session terminated or invalid (token hash: ${currentTokenHash.substring(0, 8)}...)`);
+        return ctx.unauthorized("This session has been terminated. Please login again.");
       }
     } catch (err) {
       strapi2.log.debug("[magic-sessionmanager] Error checking session:", err.message);
@@ -261,6 +294,7 @@ var lastSeen = ({ strapi: strapi2 }) => {
         const lastTouch = lastTouchCache.get(matchingSession.documentId) || 0;
         if (now - lastTouch > rateLimit) {
           lastTouchCache.set(matchingSession.documentId, now);
+          cleanupOldCacheEntries();
           await strapi2.documents(SESSION_UID$3).update({
             documentId: matchingSession.documentId,
             data: { lastActive: /* @__PURE__ */ new Date() }
@@ -347,20 +381,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             ctx.body = { message: "Logged out successfully" };
             return;
           }
-          const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+          const tokenHashValue = hashToken$2(token);
+          const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
             filters: {
+              tokenHash: tokenHashValue,
               isActive: true
             }
           });
-          const matchingSession = allSessions.find((session2) => {
-            if (!session2.token) return false;
-            try {
-              const decrypted = decryptToken$2(session2.token);
-              return decrypted === token;
-            } catch (err) {
-              return false;
-            }
-          });
           if (matchingSession) {
             await sessionService.terminateSession({ sessionId: matchingSession.documentId });
             log.info(`[LOGOUT] Logout via /api/auth/logout - Session ${matchingSession.documentId} terminated`);
@@ -451,8 +478,10 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
             userAgent,
             token: ctx.body.jwt,
             // Store Access Token (encrypted)
-            refreshToken: ctx.body.refreshToken
+            refreshToken: ctx.body.refreshToken,
             // Store Refresh Token (encrypted) if exists
+            geoData
+            // Store geolocation data if available
           });
           log.info(`[SUCCESS] Session created for user ${userDocId} (IP: ${ip})`);
           if (geoData && (config2.enableEmailAlerts || config2.enableWebhooks)) {
@@ -503,20 +532,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
         try {
           const refreshToken = ctx.request.body?.refreshToken;
           if (refreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const refreshTokenHashValue = hashToken$2(refreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: refreshTokenHashValue,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === refreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (!matchingSession) {
               log.warn("[BLOCKED] Blocked refresh token request - no active session");
               ctx.status = 401;
@@ -542,20 +564,13 @@ var bootstrap$1 = async ({ strapi: strapi2 }) => {
           const newAccessToken = ctx.body.jwt;
           const newRefreshToken = ctx.body.refreshToken;
           if (oldRefreshToken) {
-            const allSessions = await strapi2.documents(SESSION_UID$2).findMany({
+            const oldRefreshTokenHash = hashToken$2(oldRefreshToken);
+            const matchingSession = await strapi2.documents(SESSION_UID$2).findFirst({
               filters: {
+                refreshTokenHash: oldRefreshTokenHash,
                 isActive: true
               }
             });
-            const matchingSession = allSessions.find((session2) => {
-              if (!session2.refreshToken) return false;
-              try {
-                const decrypted = decryptToken$2(session2.refreshToken);
-                return decrypted === oldRefreshToken;
-              } catch (err) {
-                return false;
-              }
-            });
             if (matchingSession) {
               const encryptedToken = newAccessToken ? encryptToken$1(newAccessToken) : matchingSession.token;
               const encryptedRefreshToken = newRefreshToken ? encryptToken$1(newRefreshToken) : matchingSession.refreshToken;
@@ -684,11 +699,11 @@ var destroy$1 = async ({ strapi: strapi2 }) => {
   const log = createLogger$2(strapi2);
   if (strapi2.licenseGuard && strapi2.licenseGuard.pingInterval) {
     clearInterval(strapi2.licenseGuard.pingInterval);
-    log.info("🛑 License pinging stopped");
+    log.info("[STOP] License pinging stopped");
   }
   if (strapi2.sessionManagerIntervals && strapi2.sessionManagerIntervals.cleanup) {
     clearInterval(strapi2.sessionManagerIntervals.cleanup);
-    log.info("🛑 Session cleanup interval stopped");
+    log.info("[STOP] Session cleanup interval stopped");
   }
   log.info("[SUCCESS] Plugin cleanup completed");
 };
@@ -1169,6 +1184,7 @@ var session$3 = {
    * GET /api/magic-sessionmanager/my-sessions
    * Automatically uses the authenticated user's documentId
    * Marks which session is the current one (based on JWT token hash)
+   * Fetches geolocation data on-demand if not already stored
    */
   async getOwnSessions(ctx) {
     try {
@@ -1185,7 +1201,8 @@ var session$3 = {
       const config2 = strapi.config.get("plugin::magic-sessionmanager") || {};
       const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
       const now = /* @__PURE__ */ new Date();
-      const sessionsWithCurrent = allSessions.map((session2) => {
+      const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+      const sessionsWithCurrent = await Promise.all(allSessions.map(async (session2) => {
         const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
         const timeSinceActive = now - lastActiveTime;
         const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -1194,6 +1211,39 @@ var session$3 = {
         const deviceType = session2.deviceType || parsedUA.deviceType;
         const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
         const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+        let geoLocation = session2.geoLocation;
+        if (typeof geoLocation === "string") {
+          try {
+            geoLocation = JSON.parse(geoLocation);
+          } catch (e) {
+            geoLocation = null;
+          }
+        }
+        if (!geoLocation && session2.ipAddress) {
+          try {
+            const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+            if (geoData && geoData.country !== "Unknown") {
+              geoLocation = {
+                country: geoData.country,
+                country_code: geoData.country_code,
+                country_flag: geoData.country_flag,
+                city: geoData.city,
+                region: geoData.region,
+                timezone: geoData.timezone
+              };
+              strapi.documents(SESSION_UID$1).update({
+                documentId: session2.documentId,
+                data: {
+                  geoLocation: JSON.stringify(geoLocation),
+                  securityScore: geoData.securityScore || null
+                }
+              }).catch(() => {
+              });
+            }
+          } catch (geoErr) {
+            strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+          }
+        }
         const {
           token,
           tokenHash,
@@ -1202,6 +1252,8 @@ var session$3 = {
           locale,
           publishedAt,
           // Remove Strapi internal fields
+          geoLocation: _geo,
+          // Remove raw geoLocation
           ...sessionWithoutTokens
         } = session2;
         return {
@@ -1209,11 +1261,13 @@ var session$3 = {
           deviceType,
           browserName,
           osName,
+          geoLocation,
+          // Parsed object or null
           isCurrentSession,
           isTrulyActive,
           minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
         };
-      });
+      }));
       sessionsWithCurrent.sort((a, b) => {
         if (a.isCurrentSession) return -1;
         if (b.isCurrentSession) return 1;
@@ -1315,6 +1369,7 @@ var session$3 = {
    * Get current session info based on JWT token hash
    * GET /api/magic-sessionmanager/current-session
    * Returns the session associated with the current JWT token
+   * Fetches geolocation on-demand if not already stored
    */
   async getCurrentSession(ctx) {
     try {
@@ -1343,6 +1398,40 @@ var session$3 = {
       const deviceType = currentSession.deviceType || parsedUA.deviceType;
       const browserName = currentSession.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
       const osName = currentSession.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+      let geoLocation = currentSession.geoLocation;
+      if (typeof geoLocation === "string") {
+        try {
+          geoLocation = JSON.parse(geoLocation);
+        } catch (e) {
+          geoLocation = null;
+        }
+      }
+      if (!geoLocation && currentSession.ipAddress) {
+        try {
+          const geolocationService = strapi.plugin("magic-sessionmanager").service("geolocation");
+          const geoData = await geolocationService.getIpInfo(currentSession.ipAddress);
+          if (geoData && geoData.country !== "Unknown") {
+            geoLocation = {
+              country: geoData.country,
+              country_code: geoData.country_code,
+              country_flag: geoData.country_flag,
+              city: geoData.city,
+              region: geoData.region,
+              timezone: geoData.timezone
+            };
+            strapi.documents(SESSION_UID$1).update({
+              documentId: currentSession.documentId,
+              data: {
+                geoLocation: JSON.stringify(geoLocation),
+                securityScore: geoData.securityScore || null
+              }
+            }).catch(() => {
+            });
+          }
+        } catch (geoErr) {
+          strapi.log.debug("[magic-sessionmanager] Geolocation lookup failed:", geoErr.message);
+        }
+      }
       const {
         token: _,
         tokenHash: _th,
@@ -1350,6 +1439,7 @@ var session$3 = {
         refreshTokenHash: _rth,
         locale: _l,
         publishedAt: _p,
+        geoLocation: _geo,
         ...sessionWithoutTokens
       } = currentSession;
       ctx.body = {
@@ -1358,6 +1448,8 @@ var session$3 = {
           deviceType,
           browserName,
           osName,
+          geoLocation,
+          // Parsed object or null
           isCurrentSession: true,
           isTrulyActive: timeSinceActive < inactivityTimeout,
           minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
@@ -1901,10 +1993,10 @@ var session$1 = ({ strapi: strapi2 }) => {
   return {
     /**
      * Create a new session record
-     * @param {Object} params - { userId, ip, userAgent, token, refreshToken }
+     * @param {Object} params - { userId, ip, userAgent, token, refreshToken, geoData }
      * @returns {Promise<Object>} Created session
      */
-    async createSession({ userId, ip = "unknown", userAgent = "unknown", token, refreshToken }) {
+    async createSession({ userId, ip = "unknown", userAgent = "unknown", token, refreshToken, geoData }) {
       try {
         const now = /* @__PURE__ */ new Date();
         const sessionId = generateSessionId(userId);
@@ -1912,6 +2004,7 @@ var session$1 = ({ strapi: strapi2 }) => {
         const encryptedRefreshToken = refreshToken ? encryptToken(refreshToken) : null;
         const tokenHashValue = token ? hashToken(token) : null;
         const refreshTokenHashValue = refreshToken ? hashToken(refreshToken) : null;
+        const parsedUA = parseUserAgent(userAgent);
         const session2 = await strapi2.documents(SESSION_UID).create({
           data: {
             user: userId,
@@ -1929,8 +2022,22 @@ var session$1 = ({ strapi: strapi2 }) => {
             // Encrypted Refresh Token
             refreshTokenHash: refreshTokenHashValue,
             // SHA-256 hash for fast lookup
-            sessionId
+            sessionId,
             // Unique identifier
+            // Device info from User-Agent
+            deviceType: parsedUA.deviceType,
+            browserName: parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName,
+            osName: parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName,
+            // Geolocation data (if available from Premium features)
+            geoLocation: geoData ? JSON.stringify({
+              country: geoData.country,
+              country_code: geoData.country_code,
+              country_flag: geoData.country_flag,
+              city: geoData.city,
+              region: geoData.region,
+              timezone: geoData.timezone
+            }) : null,
+            securityScore: geoData?.securityScore || null
           }
         });
         log.info(`[SUCCESS] Session ${session2.documentId} (${sessionId}) created for user ${userId}`);
@@ -1991,6 +2098,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get ALL sessions (active + inactive) with accurate online status
+     * Fetches geolocation on-demand for sessions without it (limited to prevent API abuse)
      * @returns {Promise<Array>} All sessions with enhanced data
      */
     async getAllSessions() {
@@ -2003,8 +2111,10 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
+        let geoLookupsRemaining = 20;
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2012,6 +2122,40 @@ var session$1 = ({ strapi: strapi2 }) => {
           const deviceType = session2.deviceType || parsedUA.deviceType;
           const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
           const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+          let geoLocation = session2.geoLocation;
+          if (typeof geoLocation === "string") {
+            try {
+              geoLocation = JSON.parse(geoLocation);
+            } catch (e) {
+              geoLocation = null;
+            }
+          }
+          if (!geoLocation && session2.ipAddress && geoLookupsRemaining > 0) {
+            geoLookupsRemaining--;
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2019,6 +2163,8 @@ var session$1 = ({ strapi: strapi2 }) => {
             refreshTokenHash,
             locale,
             publishedAt,
+            geoLocation: _geo,
+            // Remove raw geoLocation, we use parsed version
             ...safeSession
           } = session2;
           return {
@@ -2026,10 +2172,12 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType,
             browserName,
             osName,
+            geoLocation,
+            // Parsed object or null
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting all sessions:", err);
@@ -2038,6 +2186,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     },
     /**
      * Get all active sessions with accurate online status
+     * Fetches geolocation on-demand for sessions without it
      * @returns {Promise<Array>} Active sessions with user data and online status
      */
     async getActiveSessions() {
@@ -2049,8 +2198,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = timeSinceActive < inactivityTimeout;
@@ -2058,6 +2208,39 @@ var session$1 = ({ strapi: strapi2 }) => {
           const deviceType = session2.deviceType || parsedUA.deviceType;
           const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
           const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+          let geoLocation = session2.geoLocation;
+          if (typeof geoLocation === "string") {
+            try {
+              geoLocation = JSON.parse(geoLocation);
+            } catch (e) {
+              geoLocation = null;
+            }
+          }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2065,6 +2248,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             refreshTokenHash,
             locale,
             publishedAt,
+            geoLocation: _geo,
             ...safeSession
           } = session2;
           return {
@@ -2072,10 +2256,11 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType,
             browserName,
             osName,
+            geoLocation,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions.filter((s) => s.isTrulyActive);
       } catch (err) {
         log.error("Error getting active sessions:", err);
@@ -2085,6 +2270,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     /**
      * Get all sessions for a specific user
      * Supports both numeric id (legacy) and documentId (Strapi v5)
+     * Fetches geolocation on-demand for sessions without it
      * @param {string|number} userId - User documentId or numeric id
      * @returns {Promise<Array>} User's sessions with accurate online status
      */
@@ -2103,8 +2289,9 @@ var session$1 = ({ strapi: strapi2 }) => {
         });
         const config2 = strapi2.config.get("plugin::magic-sessionmanager") || {};
         const inactivityTimeout = config2.inactivityTimeout || 15 * 60 * 1e3;
+        const geolocationService = strapi2.plugin("magic-sessionmanager").service("geolocation");
         const now = /* @__PURE__ */ new Date();
-        const enhancedSessions = sessions.map((session2) => {
+        const enhancedSessions = await Promise.all(sessions.map(async (session2) => {
           const lastActiveTime = session2.lastActive ? new Date(session2.lastActive) : new Date(session2.loginTime);
           const timeSinceActive = now - lastActiveTime;
           const isTrulyActive = session2.isActive && timeSinceActive < inactivityTimeout;
@@ -2112,6 +2299,39 @@ var session$1 = ({ strapi: strapi2 }) => {
           const deviceType = session2.deviceType || parsedUA.deviceType;
           const browserName = session2.browserName || (parsedUA.browserVersion ? `${parsedUA.browserName} ${parsedUA.browserVersion}` : parsedUA.browserName);
           const osName = session2.osName || (parsedUA.osVersion ? `${parsedUA.osName} ${parsedUA.osVersion}` : parsedUA.osName);
+          let geoLocation = session2.geoLocation;
+          if (typeof geoLocation === "string") {
+            try {
+              geoLocation = JSON.parse(geoLocation);
+            } catch (e) {
+              geoLocation = null;
+            }
+          }
+          if (!geoLocation && session2.ipAddress) {
+            try {
+              const geoData = await geolocationService.getIpInfo(session2.ipAddress);
+              if (geoData && geoData.country !== "Unknown") {
+                geoLocation = {
+                  country: geoData.country,
+                  country_code: geoData.country_code,
+                  country_flag: geoData.country_flag,
+                  city: geoData.city,
+                  region: geoData.region,
+                  timezone: geoData.timezone
+                };
+                strapi2.documents(SESSION_UID).update({
+                  documentId: session2.documentId,
+                  data: {
+                    geoLocation: JSON.stringify(geoLocation),
+                    securityScore: geoData.securityScore || null
+                  }
+                }).catch(() => {
+                });
+              }
+            } catch (geoErr) {
+              log.debug("Geolocation lookup failed:", geoErr.message);
+            }
+          }
           const {
             token,
             tokenHash,
@@ -2119,6 +2339,7 @@ var session$1 = ({ strapi: strapi2 }) => {
             refreshTokenHash,
             locale,
             publishedAt,
+            geoLocation: _geo,
             ...safeSession
           } = session2;
           return {
@@ -2126,10 +2347,11 @@ var session$1 = ({ strapi: strapi2 }) => {
             deviceType,
             browserName,
             osName,
+            geoLocation,
             isTrulyActive,
             minutesSinceActive: Math.floor(timeSinceActive / 1e3 / 60)
           };
-        });
+        }));
         return enhancedSessions;
       } catch (err) {
         log.error("Error getting user sessions:", err);
@@ -2242,7 +2464,7 @@ var session$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const version = "4.2.10";
+const version = "4.2.13";
 const require$$2 = {
   version
 };

package/package.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "version": "4.2.11",
+  "version": "4.2.13",
   "keywords": [
     "strapi",
     "strapi-plugin",